The term “server” is used herein in the most general sense and includes any computer or system providing some service or functionality to connecting users. When security-sensitive operations are performed by servers in data communications networks, secret data items such as cryptographic keys, passwords or other security tokens can be used by a server to authenticate operations performed by the server, i.e. to prove that the operation is performed by an authentic or authorised server. By way of example, when providing security-sensitive services to connecting users over a network, for instance banking services conducted over the Internet, it is important that communications from the server can be authenticated by recipients. An access request by a server to a restricted resource, such as a connected database, may also require authentication for example. Authentication can be achieved by the server demonstrating knowledge of a secret data item in a manner which can be verified by the other party to the operation. Such a data item is “secret” in the sense that is not known to unauthorized parties and may be secret to the server alone or to the server and a limited set of one or more authorized parties. A typical server will hold many such secret data items, e.g. for use by different applications running on the server and/or for use with different connecting parties. A banking server, for instance, will typically hold multiple private keys (i.e. the secret keys of asymmetric, public-private key-pairs) for use in its various secure operations.
Secret data items such as private server keys require management by system administrators. In particular, administrators need to backup server keys so that these can be restored to the server if necessary. For example, keys can be lost due to device failure, or due to scheduled system overhauls, and must be returned to the server to restore normal operation. Often, system administrators simply backup server keys to a file on a workstation or personal computer (PC). More security-minded administrators might store the backup file on an encrypted disc for example. In general, however, the backup process can represent a security weak-point in an otherwise secure system.
A copending patent application publication (WO2009/066217) discloses a device for improving security in electronic transactions conducted between a user PC and a remote server over a data communications network. This device is also described in “The Zurich Trusted Information Channel—An Efficient Defence against Man-in-the-Middle and Malicious Software Attacks”, Thomas Weigold et al., in P. Lipp, A.-R. Sadeghi, and K.-M. Koch (Eds.): TRUST 2008, LNCS 4968, pp. 75-91, Springer-Verlag Berlin Heidelberg 2008. The device can be connected to a user PC and sets up a secure, mutually-authenticated end-to-end connection with the server with the aid of a proxy application on the user PC which prompts the resident web browser to connect to a specific bank URL (universal resource locator). The ensuing browser session is then conducted via the secure connection and monitored by the security device. If the device detects security-sensitive information such as bank transaction details, these are displayed on the device and the user can press a button to indicate his confirmation. Only if the security device receives this confirmation will it maintain the connection and forward the transaction request to the server. This device thus allows a user to verify critical transaction details and authorize the transaction independently of the user PC.